What causes "error creating instanceGroup: %v" in kubernetes/kops?

Read the wrapped error for the specific cause.

error creating instanceGroup

Error message

error creating instanceGroup: %v

What it means

When the InstanceGroup did not exist (ig == nil) and --force allowed creation, `kops replace` calls clientset.InstanceGroupsFor(cluster).Create. This error wraps any failure returned by that Create call, meaning the new InstanceGroup resource could not be persisted to the state store.

Solutions

Read the wrapped error for the specific cause.
If it's a collision, re-run `kops replace -f ig.yaml` WITHOUT --force so the now-existing IG is updated instead of created.
Fix validation problems in the manifest (run `kops create -f ig.yaml --dry-run` to see errors).
Verify state-store write permissions and retry if transient.

Example fix

# before
kops replace -f ig.yaml --force   # Create collides after another process created it
# after
kops replace -f ig.yaml           # existing IG now goes through Update path

Defensive patterns

Strategy: try-catch

Validate before calling

// Detect not-found and create via the documented path instead of --force
_, err := clientset.InstanceGroupsFor(cluster).Get(ctx, igName, metav1.GetOptions{})
createFirst := errors.IsNotFound(err)

Try / catch

if strings.HasPrefix(err.Error(), "error creating instanceGroup:") {
    // likely a concurrent create; fall back to update path
    time.Sleep(time.Second)
    return runReplaceWithoutForce()
}

Prevention

Use a lock (CI mutex or DynamoDB lock) so only one job mutates IGs at a time
Validate manifests with --dry-run before applying
Re-check existence after a create collision instead of blindly retrying --force

When it happens

Trigger: Create fails after the existence check reported NotFound: concurrent creation by another operator/CI run, invalid IG spec rejected by validation, state-store write failure, or permission errors.

Common situations: Two pipelines running `kops replace --force` simultaneously (one creates first, the other's Create collides); manifest with invalid fields (bad machineType, missing subnets); state-store backend write errors.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7f7958afd68e68fa. Report an issue: GitHub.

Appendix: source

Thrown at cmd/kops/replace.go:189

				}
				// check if the instancegroup exists already
				igName := v.ObjectMeta.Name
				ig, err := clientset.InstanceGroupsFor(cluster).Get(ctx, igName, metav1.GetOptions{})
				if err != nil {
					if errors.IsNotFound(err) {
						if !c.Force {
							return fmt.Errorf("instanceGroup: %v does not exist (try adding --force flag)", igName)
						}
					} else {
						return fmt.Errorf("unable to check for instanceGroup: %v", err)
					}
				}
				switch ig {
				case nil:
					klog.Infof("instanceGroup: %v was not found, creating resource now", igName)
					_, err = clientset.InstanceGroupsFor(cluster).Create(ctx, v, metav1.CreateOptions{})
					if err != nil {
						return fmt.Errorf("error creating instanceGroup: %v", err)
					}
				default:
					_, err = clientset.InstanceGroupsFor(cluster).Update(ctx, v, metav1.UpdateOptions{})
					if err != nil {
						return fmt.Errorf("error replacing instanceGroup: %v", err)
					}
				}
			case *kopsapi.SSHCredential:
				clusterName := v.ObjectMeta.Labels[kopsapi.LabelClusterName]
				if clusterName == "" {
					return fmt.Errorf("must specify %q label with cluster name to replace SSHCredential", kopsapi.LabelClusterName)
				}
				if v.Spec.PublicKey == "" {
					return fmt.Errorf("spec.PublicKey is required")
				}

				cluster, err := clientset.GetCluster(ctx, clusterName)
				if err != nil {

View on GitHub (pinned to 4c8573c808)